Portugal's Under-16 Social-Media Law Nears a Final Vote, and a French Court Ruling Shows Why Age Verification Is the Hard Part

Portugal's plan to keep under-16s off social media without a parent's consent is edging toward a final vote this autumn — and a court ruling in France has just illustrated the trap it needs to avoid. On 14 August, France's Conseil Constitutionnel (Constitutional Council) struck down that country's ban on social-media accounts for under-15s, judging it a disproportionate limit on free expression that lacked adequate guarantees on age verification and privacy. President Macron ordered his prime minister to redraft a "juridically robust" text. The lesson for Lisbon: the hard part of any such ban is not the age limit but proving age.

Portugal's own diploma was approved in general terms by Parliament in February 2026 and sent to committee for detailed work. According to ECO, which reported on its progress on 31 July, the text is expected to be finalised in September or, at the latest, October. The structure is straightforward on paper: under-13s barred from accounts, 13- to 15-year-olds admitted only with verified parental consent, and 16 the age of autonomous access.

Verification is the sticking point

The mechanics are where the debate bites. The Portuguese proposal, sponsored jointly by the PSD (Social Democratic Party) and the PS (Socialist Party), would require age to be checked through a mechanism compatible with the Chave Móvel Digital (Digital Mobile Key, the state's online identity system) or an equivalent — with simple self-declaration explicitly ruled out. The platforms in scope include Facebook, Instagram, TikTok and YouTube, alongside betting and gaming services, with the PSD pushing to add messaging apps such as WhatsApp and Signal. Reported penalties run up to €2 million or 2% of a platform's worldwide annual turnover, figures drawn from the reporting on the diploma. The measure has been notified to the European Commission for compatibility with the DSA (Digital Services Act).

Not everyone is convinced a ban is the right tool. The cybersecurity firm ESET has argued since early 2026 that an age gate is a largely symbolic gesture unless matched with credible verification, and that outright bans risk pushing minors toward circumvention rather than protecting them; its counter-proposal is to separate verified from non-verified accounts instead of policing by age. It has also warned that verification itself — whether by facial analysis, ID documents or financial data — concentrates sensitive personal information and creates new fraud risks. That critique is what recent commentary has labelled a "symbolic prohibition."

What this means for readers

• Parents: if the law passes as drafted, children under 13 would be off mainstream social platforms entirely, and 13- to 15-year-olds would need a parent's verified consent — likely tied to the family's Digital Mobile Key.
• Timing: nothing is in force yet. The diploma is still in committee and not yet published in the Diário da República; a final vote is expected in the autumn.
• The EU layer: Brussels is rolling out its own age-verification app this autumn, built on the EU digital identity wallet's technology, which platforms may lean on.
• The open question: France's court defeat shows that a ban can be undone if verification and privacy safeguards are judged too weak — the same test Portugal's text will have to pass.

The direction of travel across Europe is clear enough, with several governments and the European Parliament now favouring a minimum age of 16. What France's ruling underlines is that setting an age limit is the easy part. Building an age check that is both effective and lawful — one that keeps children out without hoovering up everyone's identity data — is the problem Portugal will have to solve before its own ban means anything.